EErudika

Products

Exploited and recent CVEs

• CVE-2026-57183 Medium 6.1 Scoold: Forged JWT Accepted as Admin API Token Allowing Unauthorized Access to Sensitive Configuration and Logs 0.3%
• CVE-2026-55840 Medium 5.4 Scoold: Open Redirect in getBackToUrl() allows phishing via domain-prefix startsWith bypass 0.3%
• CVE-2026-55842 Medium 5.4 Scoold: CORS wildcard origin with credentials enabled allows cross-origin authenticated API access from any domain 0.1%
• CVE-2026-54676 Medium 6.5 Scoold: GET /api/posts/{id}/answers leaks private-space replies when personal API tokens are enabled 0.4%
• CVE-2026-54677 Medium 6.5 Scoold: Authenticated user can post replies and comments to private-space questions without space membership 0.4%
• CVE-2026-42176 Medium 6.7 Scoold: Persistent Admin Takeover by Overwriting the admins Configuration Setting via Forged JWT (missing `jti` validation) 0.3%
• CVE-2026-39354 Medium 6.5 Scoold has an Authenticated Arbitrary Question Overwrite via Client-Controlled postId in POST /questions/ask 0.2%
• CVE-2026-34832 Medium 6.5 Scoold: Cross-Account Feedback Deletion (IDOR) 0.3%
• CVE-2025-49009 Medium 6.2 Para Inserts Sensitive Information into Log File for Facebook authentication 0.2%
• CVE-2025-48955 Medium 6.2 Para Server Logs Sensitive Information 0.2%
• CVE-2024-50334 High 8.7 Semicolon Path Injection on API /api;/config 1.0%
• CVE-2022-1848 Critical 9.0 Business Logic Errors in erudika/para 1.0%
• CVE-2022-1782 Critical 9.4 Cross-site Scripting (XSS) - Generic in erudika/para 1.0%
• CVE-2022-1543 Critical 9.3 Improper handling of Length parameter in erudika/scoold 1.1%